Josep Piguillem
3897113313
Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer collective, backed by the Pireon OAuth identity server. The public site is a separate, server-rendered application consuming /api/public/v1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
74 lines
2.2 KiB
PHP
74 lines
2.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Requests\PublicApi;
|
|
|
|
use Illuminate\Foundation\Http\FormRequest;
|
|
use Illuminate\Validation\Rule;
|
|
|
|
/**
|
|
* What the frontend could not resolve.
|
|
*
|
|
* Two shapes are accepted, because both are natural on the other side: a
|
|
* single report, which is what one rendered 404 produces, and a batch, which
|
|
* is what a queue on the frontend flushes. The single form is folded into a
|
|
* batch of one before validation, so there is one code path from here on.
|
|
*/
|
|
class ReportMissingUrlRequest extends FormRequest
|
|
{
|
|
public function authorize(): bool
|
|
{
|
|
// The shared secret is the authorisation, and the middleware has
|
|
// already checked it.
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Accept `{"path": "..."}` as `{"hits": [{"path": "..."}]}`.
|
|
*/
|
|
protected function prepareForValidation(): void
|
|
{
|
|
if ($this->has('path') && ! $this->has('hits')) {
|
|
$this->merge(['hits' => [$this->only(['path', 'locale', 'referrer'])]]);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @return array<string, mixed>
|
|
*/
|
|
public function rules(): array
|
|
{
|
|
return [
|
|
'hits' => ['required', 'array', 'min:1', 'max:'.$this->maxBatch()],
|
|
|
|
// Paths, not URLs: the frontend knows its own origin, and a report
|
|
// carrying a full address would let a caller file a 404 against
|
|
// somebody else's domain.
|
|
'hits.*.path' => ['required', 'string', 'max:500', 'starts_with:/'],
|
|
|
|
'hits.*.locale' => [
|
|
'sometimes', 'nullable', 'string',
|
|
Rule::in(array_keys((array) config('locales.supported'))),
|
|
],
|
|
|
|
// Where the visitor came from, verbatim from the Referer header,
|
|
// so it can be a URL on anybody's domain.
|
|
'hits.*.referrer' => ['sometimes', 'nullable', 'string', 'url:http,https', 'max:500'],
|
|
];
|
|
}
|
|
|
|
/**
|
|
* @return array<int, array<string, string|null>>
|
|
*/
|
|
public function hits(): array
|
|
{
|
|
return array_values((array) $this->validated('hits'));
|
|
}
|
|
|
|
public function maxBatch(): int
|
|
{
|
|
return max(1, (int) config('site.telemetry.max_batch', 50));
|
|
}
|
|
}
|